Under the Digital Personal Data Protection Act, 2023, a dental clinic is a Data Fiduciary: it must give patients a clear notice, use their data only for the purposes they were told about, protect it with reasonable security safeguards, report breaches, and honour their rights to access, correct and erase it. The clinic’s software vendor is usually its Data Processor, acting on the clinic’s instructions. The DPDP Rules, 2025 bring these duties in by phases, so check the current dates.
This guide is general information, not legal advice. The Rules are still being phased in and may be amended; confirm how they apply to your clinic with a lawyer.
Does the DPDP Act apply to a dental clinic?
Yes, if you keep patients’ personal data in digital form — clinic software, an Excel sheet, X-rays on a computer, or chats and documents on WhatsApp. The Act also covers data collected on paper and digitised later, such as scanned case papers. Health information is personal data like any other under the Act, and it is among the most sensitive data a small business holds.
| Term in the Act | Who it is in a dental clinic |
|---|---|
| Data Principal | The patient. For a child under 18, it includes the parent or lawful guardian. |
| Data Fiduciary | The clinic, which decides why and how patient data is used. |
| Data Processor | Anyone handling data on the clinic’s behalf: the clinic software vendor, a cloud service, an outside IT person. |
| Personal data breach | Any unauthorised processing, or accidental disclosure, sharing, alteration, loss or destruction of personal data — a stolen laptop counts. |
| Data Protection Board of India | The body set up under the Act to handle complaints, breaches and penalties. |
What is the timeline?
- August 2023: the Act received the President’s assent.
- November 2025: the Digital Personal Data Protection Rules, 2025 were notified, starting a phased roll-out.
- The phases: provisions setting up the Board came first; most duties for businesses — notices, security safeguards, breach reporting and patients’ rights — are scheduled to apply about 18 months after the Rules were notified.
Dates can be changed by notification, so check the current position on the Ministry of Electronics and Information Technology’s website. Starting early is the practical choice: changing how a busy clinic collects and shares data takes months, not days.
What must you tell patients, and when do you need consent?
When you ask for personal data, the Act requires a notice that explains what data you collect and why, how the patient can withdraw consent or exercise their rights, and how they can complain to the Board. The patient must be able to read the notice in English or in any language listed in the Eighth Schedule of the Constitution — which includes Hindi, Gujarati and Marathi.
Where you rely on consent, it must be free, specific, informed, unconditional and unambiguous, given by a clear action, and limited to the data needed for that purpose. Withdrawing it must be as easy as giving it. The Act also lists certain “legitimate uses” that do not need consent, such as responding to a medical emergency; whether a given use fits one is a question for your lawyer.
In practice, each purpose deserves its own decision:
| Use of patient data | What to put in place |
|---|---|
| Treatment and the clinical record | A clear notice at registration, in the patient’s language, and recorded consent |
| Appointment reminders on WhatsApp | Tell the patient at registration, record that they agreed, stop when they opt out |
| Offers and promotions | A separate opt-in, never assumed from treatment consent, with an easy opt-out |
| Before-and-after photos on social media | Separate, specific consent for those photos; remove them if consent is withdrawn |
| Dental lab work | Share only what the lab needs — a case number, the tooth, the work and the shade |
| Referral to a specialist | Share what the specialist needs for that referral, and record that you did |
Our guide to WhatsApp for dental clinics covers consent and opt-outs for messages in more detail.
What counts as reasonable security safeguards?
The Act requires the clinic to take reasonable security safeguards to prevent a breach, including for data its processors handle. The DPDP Rules describe the kind of measures expected — such as encryption or masking, access control, logs that show who accessed what, and backups — so check the current text. For a dental clinic that translates into:
- Personal logins. No shared front-desk password. When someone leaves, their access ends the same day.
- Roles. A receptionist does not need clinical notes; an accountant does not need X-rays.
- A second factor for the owner, such as an authenticator code.
- An audit trail of who viewed, changed or deleted what.
- Backups you have actually restored at least once.
- Phones and laptops locked with a PIN, and no patient X-rays or reports sitting in staff members’ personal galleries or WhatsApp chats.
- Paper in locked cabinets, and old case papers shredded rather than thrown away.
What do you do if there is a data breach?
Typical clinic breaches are ordinary: a stolen laptop, X-rays posted in the wrong WhatsApp group, a former employee who still has a password, or ransomware on the front-desk computer. Prepare a one-page plan now:
- Contain it — change passwords, remove access, recover what you can.
- Work out what happened — which data, how many patients, since when.
- Inform the Data Protection Board and each affected patient. The Act requires both. The Rules set out what the notice must say and when; as notified, they ask for a detailed report to the Board within 72 hours of becoming aware, so check the current text.
- Record it — what happened, what you did and what you changed so it does not happen again.
The stakes are real: the Schedule to the Act sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach, with the Board deciding the amount in each case.
How should you handle patients’ requests?
Patients can ask the clinic for a summary of their personal data and how it has been used and shared, ask for corrections, ask for erasure, nominate someone to act for them, and raise a grievance. Publish a contact — a named person, an email address or WhatsApp number — and keep a simple log of each request and your reply.
Deletion needs care. The Act lets you keep data where another law requires it. Clinical records may have to be retained under state rules or professional guidance, so check before deleting a treatment record, explain the reason to the patient, and delete what you do not need to keep, such as their marketing preferences. For children, consent comes from a parent or guardian; the Rules include specific provisions for healthcare providers, so check how they apply to your clinic.
The clinic and its software vendor: who is responsible?
The clinic stays responsible even when a vendor processes the data. The Act allows a Data Fiduciary to engage a Data Processor only under a valid contract, so ask every vendor:
- Where is our data stored, and is it kept separate from other clinics?
- Who at your company can see it, and when?
- Can we export everything, in open formats, at any time?
- What happens to our data when we leave — and when is it deleted?
- Which other services receive our data, such as an AI provider, and what is sent?
Our guide to choosing dental clinic software in India and the comparison of cloud and desktop dental software cover these questions alongside the rest of the buying decision.
A practical DPDP checklist for a dental clinic
| # | Check |
|---|---|
| 1 | Every staff member has a personal login, with a role that limits what they see |
| 2 | The owner signs in with a second factor; leavers lose access the same day |
| 3 | An audit trail records who changed or deleted what |
| 4 | A privacy notice at registration, in English and your patients’ languages |
| 5 | WhatsApp consent recorded per patient; opt-outs honoured; promotions opt-in only |
| 6 | Separate written consent for photos used outside treatment |
| 7 | A full export tested, and backups restored at least once |
| 8 | A published contact for patients’ requests, and a log of each one |
| 9 | A deletion process that respects legal retention |
| 10 | A one-page breach plan, with who calls whom |
| 11 | A written contract with each vendor that handles patient data |
| 12 | Staff trained: no patient data on personal phones or in group chats |
How Odontra supports a clinic’s DPDP duties
With Odontra, the clinic is the Data Fiduciary and DCPL Technology Private Limited is the Data Processor, handling patient data only to provide Odontra on the clinic’s instructions. Each clinic gets its own private database, created in Cloudflare’s Asia-Pacific region and never shared with another clinic, with authenticator sign-in for the owner, personal logins with five roles, an activity trail, daily restore points and a full export in open formats at any time; when the agreement ends, the data is returned and then deleted, normally within 30 days, unless the law requires keeping it. Every automatic WhatsApp message has its own switch and respects opt-outs, and the AI stays off until the clinic switches it on, using the clinic’s own AI account; in voice charting, names and phone numbers are removed before dictation is sent. Odontra does not claim third-party certifications; see security for the details, or book a demo and ask us your questions.